All Apps and Add-ons

Distributed vs Streaming command

valiquet
Contributor

Is there a way to know the load an SPL query puts on the index vs the search head cluster when running? By looking at the doc, it's not always clear, so perhaps is there some REST call or job inspector values I can check?

If not, some CLI could give us some clues inside var/run/lib.

Thanks

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

If you let the job finish and look at the job inspector, you can see how long each part of the search required, how many events went into each step and how many came out. That combined with the list of known distributed vs streaming commands will provide some insight here.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

If you let the job finish and look at the job inspector, you can see how long each part of the search required, how many events went into each step and how many came out. That combined with the list of known distributed vs streaming commands will provide some insight here.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...